Description

Detects when the protection rule of a GitHub repository's default branch keeps existing approvals after new commits are pushed to a pull request. The approval then covers code nobody reviewed, so an author can obtain a review on harmless changes and push different ones before the merge.

Detection Strategy

• Lists every repository in the GitHub organization, taking the default branch name and the caller's permissions from the listing itself

• Skips repositories where the credential lacks admin permission, since branch protection cannot be read without it

• Reads the stale review dismissal flag from the branch protection settings, which is only meaningful where reviews are required at all

• Reports a vulnerability when approvals survive new commits; a branch that requires no review is left to the code review check so that one setting does not produce two findings